Submission Details
Severity:
Use `require` instead of `assert`
Summary
Use require instead of assert
Vulnerability Details
Prior to solidity version 0.8.0, hitting an assert consumes the remainder of the transaction's available gas rather than returning it, as require()/revert() do. assert() should be avoided even past solidity version 0.8.0 as its documentation states that The assert function creates an error of type Panic(uint256). ... Properly functioning code should never create a Panic, not even on invalid external input. If this happens, then there is a bug in your contract which you should fix.
Proof Of Concept
File:2023-09-ditto/contracts/libraries/LibAsset.sol
16: assert(tokenContract.balanceOf(msg.sender) < walletBalance);
Context:-
File:2023-09-ditto/contracts/facets/MarginCallSecondaryFacet.sol
87: assert(tokenContract.balanceOf(msg.sender) < walletBalance);
Context:-
MarginCallSecondaryFacet.sol#L87
File:2023-09-ditto/contracts/bridges/BridgeReth.sol
106: assert(sent);
Context:-
Tools Used
Manual review
Recommendations
Use require()
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.